Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-85442HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet AllocationEPSS 0.4%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.4%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.4%CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.4%CVE-2026-54059HIGHPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2026-24158HIGHNVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a EPSS 0.4%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.4%CVE-2026-55149HIGHVouch Proxy: Unbounded Multipart Cookie Allocation DoSEPSS 0.4%CVE-2026-25899HIGHFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationEPSS 0.4%CVE-2026-59204HIGHPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceEPSS 0.4%CVE-2024-41762MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-58067HIGHA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.EPSS 0.4%CVE-2018-25368HIGHNord VPN 6.14.31 Denial of Service via Password FieldEPSS 0.4%CVE-2026-71218MEDIUMIperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustionEPSS 0.4%CVE-2025-62599HIGHeprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2024-37071MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-11579MEDIUMDoS via Out Of Memory CrashEPSS 0.4%CVE-2025-54801HIGHFiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderEPSS 0.4%CVE-2026-84857MEDIUMsigoden aichat API Endpoint serve.rs memory allocationEPSS 0.4%